Flirting with SOX 404

SOX Flirting with SOX 404 Are private companies interested in a relationship? B Y M ARIANNE B R ADFORD, CPA, AND J OE B R AZEL, CPA It has been five years since Congress passed the Sarbanes- Oxley Act of 2002 (SOX). Many publicly traded companies have gone through at least one year of compliance for one of the most costly parts of the Act, Section 404, which requires management at those companies to assess the effectiveness of their internal controls over financial reporting and issue their findings in a public report. The legislation also mandates that auditors attest to management s findings, perform an independent assessment of control reliability, and issue their own report. For many public companies, SOX came with an exorbitant price tag. According to AMR Research, companies spent roughly $6 billion a year in 2005 and 2006 to comply with SOX. (The figure didn t change much because smaller public companies are beginning to comply for the fiscal year ending December 15, 2007.) Another report estimates that the average company spent $2.9 million on SOX compliance in 2006 vs. $3.8 million in 2005 and $4.5 million in 2004. While some pundits hailed SOX as the savior of corporate governance, others shared their disdain for it. There is no shortage of articles denouncing SOX for its spiraling cash outlays, including increased internal audit and accounting staff and external audit and consulting fees. With all this negative press, is it possible that private companies are voluntarily submitting to its promulgation? A recent survey found that some private companies are flirting with SOX, seeing the benefit in a long-term relationship but starting off with baby steps. THE SOX BURDEN Enacted to clean up the corporate image after the collapses of Enron and WorldCom, SOX placed a heavy burden on public companies. A 2005 study by Chicago law firm Foley & Lardner, LLP found that the average cost of being a public company increased 233% for firms with less than $1 billion in revenue, and a typical large corporation paid $14.3 million in corporate governance costs most of which went to comply with Section 404. Another study conducted by the Big 4 accounting firms found that the average annual expenditure for public companies to 48 STRATEGIC FINANCE I September 2007

maintain their listing was $7.8 million in 2005. Some CEOs, worn out by the rising costs, are rethinking why they bother being public after all. According to a recent study, 920 companies voluntarily deregistered securities with the Securities & Exchange Commission (SEC) from 1998 through 2004, with 450 of those deregistrations occurring in 2003 and 2004. Although a major reason may be the additional SOX-related costs of being publicly traded, there is speculation that some companies fear their accounting and controls won t stand up to higher scrutiny and thus want to avoid the spotlight s glare. For many, staying public can mean more risk along with more expense. THE PRIVATE COMPANY AND SOX It took an Act of Congress (literally) to serve as a wakeup call for public companies. Now, at the state level, some legislators, regulators, and other elected or appointed officials are turning their attention to privately held companies, seeking to enact legislation to apply the Act s provisions to these companies and their auditors. Industry groups are also taking an interest in SOX. The National Association of Insurance Commissioners (NAIC) is actively discussing how SOX should be adopted by insurance companies and enforced by states. Experts in healthcare would also like to see SOX applied to health-related entities. Private company board members with public company backgrounds are starting to require Sarbanes-Oxley-type corporate governance practices. Furthermore, as lenders and insurers encounter more stringent corporate governance practices in public companies, they may begin imposing analogous standards on private companies. While such plans may take some time to gain ground, recent reports suggest that private companies are already adopting SOX initiatives voluntarily. According to some analysts, hard economic times have played a part in private companies newfound interest in corporate governance. Taking steps toward acting like a public company, or becoming SOX ready, could lower the risk for acquisition-minded companies and their underwriters, placing the target in a competitive advantage. Other ben- ILLUSTRATION: IMAGEZOO September 2007 I STRATEGIC FINANCE 49

efits might include reductions in lending and insurance costs and support for preparation of Statement on Auditing Standards No. 70 (SAS 70), Service Organizations, the first step of which is to document internal controls. But not all private companies are enthusiastic about complying with SOX, especially Section 404. They know how expensive it could be and aren t sold on its benefits. Although the press has touted justification in the form of bottom line rewards, management teams at privately held companies are generally skeptical. According to a 2005 study by Financial Executives International (FEI), the only real benefit survey respondents (financial executives) saw in 404-type compliance was to set their companies up for going public in the future. The majority (60%) either disagreed or strongly disagreed that the Act should be the benchmark for private company corporate governance. Certification of internal controls, the linchpin of Section 404, was the Companies realize that to design and maintain a control structure that will be sustainable and reap rewards in the future, they ultimately must embed control into the fabric of their business processes, procedures, and culture. most unpopular practice among respondents, with only 12% stating their company currently certifies internal controls and only 22% considering it. The goal of the FEI study was to highlight overall SOX practices that private companies are adopting, such as establishing audit committees and corporate ethics policies. The study wasn t specific to costly 404-related activities. In 2006, we surveyed members of the Institute of Management Accountants (IMA ) who held accounting and finance positions at private and public companies. The findings are very interesting and lend insight into the evolving relationship between SOX Section 404 and private companies while comparing their experiences to those of public companies. Our survey examines if and how 404 affects privately held company behavior and seeks to answer a basic question: Are privately held firms voluntarily performing SOX Section 404-related activities? Is it true that a mounting number of privately held companies are voluntarily adopting 404-type provisions (i.e., documentation and testing of controls)? If so, what s the price tag on voluntary compliance? How do private companies costs compare to those of public companies? In addition, what steps are public and private companies taking to minimize these costs (e.g., automating controls, outsourcing internal audit)? And if the mounting costs of Section 404 cause public firms to consider delisting, is it also keeping private firms from going public? THE SURVEY RESULTS Of the 177 IMA members responding, 67% work in private companies. The majority, 57%, hold undergraduate accounting degrees, and 40% have graduate business degrees. Eighty-two percent hold professional certifications mainly Certified Public Accountant (CPA), 51%, and Certified Management Accountant (CMA ), 37%. Their positions include controller/ assistant controller (29%), manager/director (23%), and others. Sixty-two percent work in small to medium-size enterprises with fewer than 1,000 employees. Manufacturing and retail (39%) and finance, real estate, and insurance (14%) are the most represented industries in our sample, followed by other services, healthcare, the public sector, technology, oil/gas/energy, and telecommunications/transportation. Costs of Documenting and Testing Controls Eighty-two percent of our public company respondents stated that the cost of documenting and testing controls was a moderate or significant burden to their companies compared to 57% of private company respondents. As to the relative costs (as a percentage of revenue) that public and private companies incur, the burden is obviously heavier on public companies, with 33% spending more than 1% of annual revenues on 404 activities. Yet a good number of private companies (27%) also spend more than 1% of their annual revenues on documentation and testing of controls (see Table 1). Are there any differences in their spending patterns? Many public firms experienced a dramatic increase in external audit fees because of the additional work required; in fact, 70% of public company respondents reported an increase greater than 10%. But this isn t limited to public companies; 81% of private company respondents stated their firm experienced an increase in external audit fees, with 46% experiencing an increase greater than 10% (see Table 2). 50 STRATEGIC FINANCE I September 2007

Table 1: Cost of SOX Section 404-Related Activities UNDER 1% OF REVENUE 1%-2% OF REVENUE 2%-4% REVENUE OVER 4% OF REVENUE Public: SOX Section 404 Compliance 67% 13% 17% 3% Private: Documentation and Testing of Controls 73% 19% 6% 2% Our evidence suggests that audit fees are on the rise, yet this is just one cost component of 404 compliance (or, in the case of private companies, documenting and testing controls.) Many companies beefed up accounting personnel and internal audit staff or hired consultants. A 2006 PricewaterhouseCoopers study revealed that more than half the companies surveyed reported an increase in internal audit resources, with 15% reporting more than a 50% jump. Our survey measures the increase in internal audit staff from 2003 to 2006. A larger percentage (64%) of public companies increased their internal audit staff, and 14% increased internal audit staff more than 30%. Only 13% of private companies with an internal audit department increased staff. It appears that private companies are hiring more accounting personnel (42%) or using consultants (30%) for documenting and testing controls. Outsourcing Internal Audit Companies also resort to outsourcing certain functions, such as internal audit. Only 5% of private companies outsourced relevant internal audit functions because of the additional burden required to document, evaluate, and test controls, although an additional 10% outsourced internal audit for other reasons. Twenty-six percent of our public companies outsourced the internal audit function because of Section 404, with another 7% outsourcing it for another reason. Companies also outsource the more complicated steps of compliance: the new technologies needed for automation and testing of internal controls. According to AMR Research, more than a quarter of cash outlays for SOX 404 will pay for new technology and systems. Automating Controls and Reengineering Processes A study by AMR Research estimates that of the $6 billion public companies spent on SOX, about $1.9 billion (32%) was on technology. While SOX delayed many information systems projects for fear that the inevitable disruptions would precipitate a compliance nightmare, funds are still being spent on technology in the form of tightening up ( turning on ) application controls already embedded in enterprise resource planning (ERP) systems (further adding to the return on investment (ROI) from initial ERP investments) and adding additional software packages. Companies realize that to design and maintain a control structure that will be sustainable and reap rewards in Table 2: SOX Section 404-Related Components As a result of SOX Section 404 compliance (and, for private companies, documentation and testing of internal controls over financial reporting in the last three years) has your company seen an increase in: No < 10% 10%-20% 20%-30% >30% External Audit Fees Public 25% 5% 35% 20% 15% Private 19% 35% 30% 14% 2% Internal Audit Staff Public 36% 28% 14% 8% 14% Private 87% 4% 4.5% 0% 4.5% Accounting Personnel Public 59% 31% 5% 0% 5% Private 58% 27% 4% 6% 5% External Consultants Public 49% 38% 5% 3% 5% Private 70% 26% 4% 0% 0% September 2007 I STRATEGIC FINANCE 51

Table 3: SOX Section 404-Related Software Purchases SOX 404 Workflow Management Flowcharting Business Process IT Controls Continuous Compliance Software Software Software Improvement Software Software Auditing Mechanisms Public 31% 21% 26% 3% 10% 10% Private 2% 32% 36% 13% 17% 0% the future, they ultimately must embed control into the fabric of their business processes, procedures, and culture. For many, IT appears to be the vehicle for that. Lack of IT controls can cost BIG money. A 2005 Ernst & Young study revealed that IT controls were the largest contributor to Section 404 remediation (72%) among a sample of companies that previously reported a material weakness in internal controls. Software packages that assist in 404-type activities include tools for SOX compliance, workflow management, flowcharting, business process improvement, IT controls, and continuous auditing mechanisms. They enable companies to map out their processes, identify their controls, create audit trails, improve the timing/communication of events, and provide more detailed business results. We were interested in comparing relevant public and private company IT investments. The rate of adoption for private companies exceeds that for public companies for workflow management (32%), flowcharting (36%), business process (13%), and automated IT controls software (17%), as you can see in Table 3. This demonstrates that investments in some types of SOX-related IT are just as important to private companies as to public ones. We also wanted to determine whether having an ERP system could reduce costs. From our sample, 66% of public and 43% of private companies surveyed had an ERP system. But only 18% of public and 22% of private companies felt that ERP reduced 404-relevant costs, and an equal percentage (20%) of both public and private companies believed their ERP system assisted with SOX compliance. Further analysis showed that many companies had only implemented a few ERP modules and were retaining legacy systems. Because of this, it isn t surprising that a higher percentage aren t realizing the full value of centralized automated controls. Those respondents who believed ERP systems assisted with SOX-type activities noted less redundancy in controls testing, streamlined and standardized processes, and less paperwork. Many companies in our sample have reengineered their business processes a staggering 98% of public and 84% of private companies. Nearly 60% of private and 25% of public companies stated that their company had undergone moderate to extensive change in business processes. Documentation of Internal Controls We also were interested in whether our respondents placed more emphasis on reading or preparing systems documentation in their day-to-day activities (see Table 4). Eighty-two percent of public and 72% of private company respondents show increased emphasis on reading or preparing information systems documentation over the last three years. This further points to the fact that private companies are allocating resources toward SOX 404-type activities. In addition, we wanted to examine whether organizations had established formal procedures on how to update, modify, or create systems documentation. Seventysix percent of public companies had established formal procedures, while only 48% of private companies had done so. For both public (49%) and private (52%) companies, upper-level management most often approves documentation, followed by the accounting department (21% and 18%, respectively). It appears that both groups are elevating the importance of systems documentation review from lower levels to top management. Overall, reading and understanding systems documentation is more important to both public and private company respondents (32% and 30%, respectively, state that it is very important in their current jobs as accounting/ finance personnel) than is the preparing of documentation (14% and 15%, respectively, call it very important). The Time It Takes SOX critics cite the loss in employee productivity as a major cost component. At least in the earlier stages, internal personnel were reassigned for longer than anticipated because companies were unsure about the human resources required for compliance. According to AMR Research, approximately 40% of the dollars spent on compliance is estimated to represent internal company time, such as when employees are pulled off other projects to devote time to SOX. Few arti- 52 STRATEGIC FINANCE I September 2007

Table 4: Emphasis on Reading or Preparing System Documentation Significant Increase Moderate Increase Slight Increase No Increase Public: 41% 30% 11% 18% Private: 23% 29% 20% 28% cles take into account the substantial amounts of time employees and executives spend in meetings, seminars, and actual work related to 404. Furthermore, there are no statistics on the relative amount of time spent by personnel in private firms. We asked respondents how many days accounting and internal audit staff spend on 404 tasks in an average work week. As expected, nearly all of our public company respondents (94%) stated their accounting staff spent time on 404 compliance in 2006, with approximately 22% spending more than two days a week. A smaller, but substantial, percentage (57%) of private company accounting staff spend time during the typical work week on documentation and testing of controls; only 4% spend more than two days. Again, this points to the increased emphasis on internal control documentation and testing practices at private companies. Staying Private As a result of SOX, some smaller public companies have delisted or gone dark to avoid rising costs. Reports suggest that some private companies stay private primarily because of SOX s inevitable burden. Being a privately held company these days has its advantages. Not only can companies avoid compliance costs, using that capital for other activities like growing the business, but they also remain (or go) private to lower their risk. Some people suggest that although SOX was designed to provide additional corporate transparency, it has instead prompted some companies to consider delisting or staying private. These companies might be hesitant to open up to increased outside scrutiny, fearing that their internal processes won t stand the test. Others may be unwilling to accept the risk associated with accounting errors or fraudulent financial reporting. Insiders may also want to evade outside monitoring because they aren t managing their firm in the most efficient way or because their compensation is excessive. We asked IMA members about the likelihood of their company going private (public companies) or staying private (private companies). Only 6% of public companies believe 404 is a reason to go private in the future (a lower percentage than in earlier studies). Possibly, former public companies that were trying to reduce expenditures/risks by avoiding 404 may have already delisted prior to our survey. Interestingly, 95% of private companies stated that potential 404 compliance has nothing to do with their companies staying private. CHANGING BUSINESS PRACTICES Overall, our survey showed that, despite all the doom and gloom surrounding SOX Section 404, privately held companies do appear to be adopting some 404-related practices. Although not to the extent of public companies, private companies have experienced post-sox audit fee increases, and they appear to spend substantial resources on documenting and testing internal controls. In fact, private companies appear to devote more resources to acquiring additional accounting personnel and external consultation and spending less on beefing up their internal audit departments or outsourcing. As expected, public companies were more likely to purchase compliance software, but private companies were more likely to purchase other forms of relevant software, such as for workflow management. At both public and private companies, accounting personnel spend more time reading and preparing systems documentation, and top management is now more actively engaged in reviewing it. In short, many SOX Section 404 activities and experiences are similar in public and private companies. Such similarities suggest that many private companies are voluntarily adopting 404-related components as best practices. Where dissimilarities exist, it appears that private companies perceive that such practices don t add value to their enterprise. While 404 may be mandatory for public companies only, it has changed the business practices of many privately held corporations. Marianne Bradford, CPA, Ph.D., is an associate professor, and Joe Brazel, CPA, Ph.D., is an assistant professor in the Department of Accounting at North Carolina State University s College of Management. You can reach Marianne at marianne_bradford@ncsu.edu. September 2007 I STRATEGIC FINANCE 53